NestJS SaaS boilerplate: a starter kit with auth, Stripe, teams and Postgres

CrabStack is a SaaS starter kit with a NestJS 12 backend, a Next.js 16 frontend and PostgreSQL. You get the full source as a private GitHub repository. It is sold once: $199 for one developer, $349 for a team of up to five, before tax, with updates by git pull.

This page covers what the template contains, how a feature gets built in it, and who it is a poor fit for.

Why a separate NestJS backend

A SaaS backend collects rules over time: who may call a route, what a paid plan unlocks, what account deletion erases. NestJS gives each of those rules a fixed place. Routes live in controllers, access rules live in guards, business logic lives in services, and each feature is one module folder.

That structure matters when an AI coding agent writes most of the code. The agent can find where new code goes from the folder names and the instructions in the repo. A reviewer can check a change by its shape.

The backend is its own application on port 4000. The frontend is a separate Next.js application on port 3000. They talk over REST, and openapi.json at the repo root is the contract between them.

What ships

• Sign-in. GitHub and Google OAuth plus email magic links, through Auth.js (NextAuth v5) with database sessions.
• Stripe billing. Subscriptions through Stripe Checkout and the Customer Portal, a sample one-time product, and a webhook handler that verifies signatures and survives duplicate and out-of-order events. Billing stays off until you add Stripe keys.
• Teams. Every user has a personal workspace and can create shared ones with owner, admin and member roles, email invites and API keys.
• PostgreSQL through Knex. 20 numbered migrations, transactions for multi-table writes, and an email queue that runs inside Postgres with no Redis.
• An admin MCP server. 17 tools that let an AI agent run the live app: publish blog posts, look up users, read email stats, check a user's billing.
• Account deletion. A queued worker erases a user's personal data and overwrites the identifying fields of their user row, so content that points at it still resolves.
• Agent instructions. AGENTS.md, a CLAUDE.md for each half, and a new-module skill.
• Tests. More than 1,000 test cases across both halves. Database tests run against a real Postgres.

How a feature gets built

Every feature module follows one pattern: a zod schema, a DTO with its extractor, a service, a controller. The new-module skill walks an agent through all of it from one sentence: the Knex migration, the schemas, the service and controller, the route's access rule, the regenerated OpenAPI spec and frontend types, a page if you want one, and the specs.

The skill ends with ./verify.sh. That script runs lint, unused-code checks, the build, and the unit and integration tests of both halves, then checks the generated files for drift. Some checks run only in CI, among them the Playwright smoke test, a second test run against a used database, the Docker stack boot and a second Node version. The feature is not done until ./verify.sh passes.

What CI refuses

Four checks fail the build when an agent skips a step:

• A route that does not state its guards, or a reason for being public, fails route-auth.spec.ts.
• A table without a rule for what account deletion does to it fails the deletion-policy spec.
• A controller change without a regenerated openapi.json fails the OpenAPI drift check.
• Frontend types that no longer match the spec fail the type drift check.

Who it fits

People who build mostly with Claude Code, Cursor or Codex, want a backend that is its own application, and want checks that catch what the agent forgets. You're buying the architecture, not the code.

Who it does not fit

• You want Prisma, Drizzle or TypeORM. The template uses Knex, a query builder.
• You need a database other than PostgreSQL.
• You need a payment provider other than Stripe.
• Not included: file uploads, websockets, MFA, a third-party UI library, a database, schema or domain per tenant (workspaces share one database), or languages beyond English (i18n is set up, English ships).
• You want Nuxt or another frontend framework. The frontend is Next.js.

Related

• NestJS and Next.js boilerplate: how the two halves connect
• NestJS Postgres boilerplate: Knex, migrations and database tests
• NestJS Stripe boilerplate: webhooks and subscriptions
• NestJS multi-tenant boilerplate: workspaces and isolation
• Claude Code SaaS boilerplate: the agent files
• Docs: Getting Started, Adding a Module, Testing
• Compare: vs ShipFast, vs Makerkit, vs supastarter

FAQ

What is in the CrabStack NestJS starter kit? A NestJS 12 backend, a Next.js 16 frontend and PostgreSQL, with sign-in, Stripe subscriptions and one-time payments, teams with roles and invites, an email queue, a blog, an admin backoffice, an admin MCP server and more than 1,000 test cases.

Which versions does it use? NestJS 12, Next.js 16 with the App Router, React 19, TypeScript 6, zod 4, Knex 3, openapi-fetch and openapi-typescript 7. Node 24 and Node 26 are both supported, and CI runs both.

Can I read the docs before buying? Yes. The documentation that ships in the repo is published at crabstack.dev/docs.

Is it a subscription? No. You pay once, and updates arrive by git pull. The Personal license covers unlimited projects for yourself or your clients.

How do I start a new project from it? Run ./setup.sh from the repo root, then docker compose up -d frontend backend maildev. The Getting Started guide goes from a fresh clone to a signed-in admin and a first feature.